LEGAL · PRIVACY

Privacy policy

We collect and process data needed to operate, secure, and improve SleeveFolio, including usage analytics and session analytics described below.

1. What we collect

Identity data from Auth.js (Google, GitHub, or email). Encrypted broker keys you supply. Trading state your strategies generate (orders, fills, positions, signals). Billing metadata from Stripe. Usage analytics (page views, feature events) and session analytics, which may include replay of in-app interactions; broker keys and other secrets are never sent to analytics providers.

2. Sub-processors

Alpaca (your broker — trades run in your own Alpaca account using the keys you supply), Stripe (billing), Resend (email), Neon (Postgres database), Vercel (hosting + analytics), Sentry (errors), Inngest (background jobs + schedules), Google Analytics (usage analytics), Hotjar (session analytics + replay), Upstash (rate-limit state), and Google / GitHub (sign-in, when you choose them). Each receives only what their function requires.

Market-data providers (Tiingo, Alpaca's IEX data, Finnhub, CoinGecko, Financial Modeling Prep, Binance's public API, and SEC EDGAR) supply general market and reference data. We do not send your personal information to these providers.

3. Encryption + retention

Broker keys are AES-256-GCM encrypted at rest. Audit logs are partitioned per user and retained per tier: Free 30 days, Pro 7 years. Delete-account erases all your rows and deletes your stored broker keys — revoke the keys themselves in your Alpaca dashboard (Alpaca offers no way for us to revoke them for you); the audit slice is archived for the tier retention window then hard-deleted.

4. Your rights

Export your audit log as JSONL from Settings. Delete your account any time (Settings → Account → Delete account, email type-to-confirm).

Effective upon your acceptance at account creation and your continued use of SleeveFolio.